<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 09/04/2026 09:57, rob777 via
Pdns-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAAPVCxwb30k9bPcbPUDqbjxdHvvzvc4chZ_9v1Ssmeeeh1HUQw@mail.gmail.com">
<div>The headache comes indeed mainly with this few shadow records
- tough i'm not sure if i mean exactly the same as you with the
term "Shadow Record".</div>
<div><br>
</div>
<div>Example what i mean:<br>
<br>
</div>
<div>External Side:</div>
<div>- a configured A Record <a
href="http://server01.bla.test.com" moz-do-not-send="true">server01.bla.test.com</a>
points to 194.88.45.32 on the external Public Zone of <a
href="http://test.com" moz-do-not-send="true">test.com</a> in
the AWS R53 config</div>
<div>- only external clients are resolving <a
href="http://server01.bla.test.com" moz-do-not-send="true">server01.bla.test.com</a>
to this 194.88.145.32 IP</div>
<div><br>
</div>
<div><br>
</div>
<div>Internal Side:<br>
</div>
<div>- a configured A Record <a
href="http://server01.bla.test.com" moz-do-not-send="true">server01.bla.test.com</a>
points to 192.168.1.22 on the internal <a
href="http://bla.test.com" moz-do-not-send="true">bla.test.com</a>
Zone on the internal Powerdns Authoritative</div>
<div>- only internal Clients/Servers resolve <a
href="http://server01.bla.test.com" moz-do-not-send="true">server01.bla.test.com</a>
to this 192.168.1.22 IP via the forward-zone=<a
href="http://bla.test.com" moz-do-not-send="true">bla.test.com</a>
on the internal DNS Recursor</div>
<div><br>
</div>
</blockquote>
<p>Ah, so these subdomains are also visible to public clients, not
purely for internal consumption? And you're going to sign these
subdomains?</p>
<p>To get internal clients to see a different result for
server01.bla.test.com than what is in the public DNS, configuring
a Response Policy Zone on the recursor is the way I'd do it. This
is what RPZ is designed for: to override specific DNS answers.</p>
<p>However, I believe it should also work to have a different,
internal-only (and unsigned) bla.test.com zone with forward-zones
and NTA for bla.test.com on the recursor.</p>
</body>
</html>